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1. A network processing system for use in a network, the network passing 
a plurality of data packets, which form a plurality of flows, the network processing 
system comprising: 

a network interface operable to receive data packets from the network and 
further operable to send processed data packets back onto the network; and 

a learning state machine in communication with the network interface, the 
learning state machine operable to learn and maintain state for particular flows, 
wherein the learning state machine assigns an identifier to one or more of the 
particular flows and associates each data packet belonging to that flow with the 
identifier, the learning state machine further operable to identify characteristics of one 
or more of the particular flows and to store those characteristics in a state database in 
the learning state machine such that the network processing system is able to treat the 
data packets based on the state of the associated flow. 

2. The network processing system of Claim 1 further comprising a second 
learning state machine, wherein each learning state machine is unidirectional in the 
opposite direction thereby creating a bi-directional network processing system, 
wherein the learning state machine and the second learning state machine are able to 
share state information concerning related flows. 

3. The network processing system of Claim 1 wherein the learning state 
machine identifies events and characteristics of each of the particular flows by 
comparing the contents of each of the particular flows to a database of known 
signatures, wherein a match with one of the known signatures corresponds to a certain 
event or characteristic. 

4. The network processing system of Claim 3 wherein a treatment for 
each data packet is determined based on the results of the comparison with the 
database of known signatures. 

5. The network processing system of Claim 1 wherein the learning state 
machine is able to examine the entire contents of each data packet and to maintain 
state across packet boundaries. 
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1 6. The network processing system of Claim 3 wherein the database of 

2 known signatures is programmed at a separate server and downloaded into the 

3 network processing system in the form of an image file. 

1 7. The network processing system of Claim 6 wherein the events and 

2 characteristics learned by the network processing system are compiled into statistics 

3 for the network. 

1 8. The network processing system of Claim 1 wherein the learning state 

2 machine includes a header preprocessor for examining header information in the 

3 packet, a content processor for comparing the packet to the database and determining 

4 a treatment, and a quality of service processor for modifying the packet and directing 

5 the packet according to the treatment. 

1 9. The network processing system of Claim 8 wherein each learning state 

2 machine further includes a microprocessor for data packets that require additional 

3 processing. 
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1 10. A network processing system for use in a network, the network 

2 consisting of multiple flows each flow formed by multiple data packets, the network 

3 processing system comprising: 

4 at least one left line interface operable to receive data packets from the 

5 network and to send processed data packets onto the network; 

6 at least one right line interface operable to receive data packets from the 

7 network and to send processed data packets onto the network; 

8 a right learning state machine receiving data packets from the left interface, 

9 and sending processed data packets to the right line interface; and 

10 a left learning state machine receiving data packets from the right interface, 

1 1 and sending processed data packets to the left line interface; 

12 each of the right and left learning state machines further comprising: 

13 a traffic flow processor processing the data packets to associate each 

14 data packet with a particular flow, to maintain state for each flow, and to 

15 compare one or more flows to a database of known signatures, such that a 

16 match with one or more signatures within the database of known signatures 

17 causes the network processing system to apply a treatment to the flow; 

18 a quality of service processor communicating with the traffic flow 

19 processor and receiving the treatment, such that the quality of service 

20 processor uses the treatment to determine the handling of the data packets and 

21 their associated flow. 

1 11. The network processing system of Claim 10 wherein the handling of 

2 the data packets and their associated flow includes modifying the contents of the data 

3 packets. 

1 12. The network processing system of Claim 10 wherein the left and the 

2 right learning state machines exchange information concerning flows. 

1 13. The network processing system of Claim 10 wherein the traffic flow 

2 processor is comprised of a header preprocessor and a content processor, the header 

3 preprocessor operable to examine header information for each packet, and the content 

4 processor operable to compare the packet with the database of known signatures. 
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1 14. The network processing system of Claim 10 wherein the state includes 

2 information concerning the characteristics of the flow as well as a record of events 

3 contained in the flow. 

1 15. The network processing system of Claim 10 wherein the state existing 

2 for the particular flow at the time a new packet belonging to the particular flow is 

3 examined, is used in conjunction with the database to determine the treatment. 

1 16. The network processing system of Claim 10 wherein the database of 

2 known signatures is programmed using a management interface on a separate server 

3 and downloaded into the network processing system in the form of an image file. 

1 17. The network processing system of Claim 16 wherein the management 

2 interface also acts to retrieve statistical and event information from the network 

3 processing system. 
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